Unknown users will show up when the MobiLink server doesn't know the user name. This can happen because the server is expecting to receive the user name, but simply hasn't yet; for example, if a request gets stuck while doing an SSL handshake it will show up with an 'Unknown' user. You will also see 'Unknown' users because some request types don't send the user name; for example some Listener requests don't. I think there might be some requests from the mlagent that don't, as well.

I'm not sure how to identify failed syncs. In the old ML Monitor it was really obvious, but maybe that changed? I'll point the guy that works on the GUI at this thread.

By default, failed syncs show up as red in the Overview pane and are overlaid with a diagonal stripe pattern in the Chart pane. You can also enable extra columns in the Table pane (via Tools>Options>Table) such as sync_errors, active and completed, if you want to find failed syncs in the Table.

Once you've identified a failed sync, open the properties for it. Any error or warning messages for the sync are shown on the Synchronization tab.